Search — “134.209.82.225”

Tampered anthropic.claude-code versions 2.1.312 and 2.1.313 were served by the Cursor extension marketplace for about 11 hours on Oct 29, 2026, exposing up to 5,000 developers. An injected JavaScript loader in extension.js collects host recon (Git email, env-var names matching KEY/TOKEN/SECRET), appends an svc-telemetry SSH key to authorized_keys, tries to enable SSH, opens a reverse tunnel (-N -R '*:0:localhost:22') to 134.209.82.225, and persists via LaunchAgent com.apple.sysmond, @reboot cron, or SysMon scheduled task/Startup sysmon.cmd. Coding errors likely blocked remote access on many macOS/Windows hosts, but keys and persistence may still be written; hunt for the svc-telemetry key, .smt/.smtk/.stk_ files, ssh/autossh child processes of Cursor, and connections to the C2.

A malicious version 2.1.313 of the Claude Code extension (ID anthropic.claude-code) was distributed via the Cursor Marketplace between ~2:27 a.m. and 1:35 p.m. PT on Oct 29, 2026, reaching at most 5,000 users. A 66-line JS loader adds an attacker SSH key labeled 'svc-telemetry' to ~/.ssh/authorized_keys, tries to enable SSH, opens a reverse tunnel to 134.209.82[.]225, installs persistence (scheduled task/crontab/LaunchAgent), and beacons host recon over HTTP to port 8099. Enabling SSH fails without admin rights on most macOS/Windows hosts, but key, persistence and beacon still occur; no follow-on payloads observed. Hunt for the svc-telemetry key, new persistence spawned by the IDE, and outbound connections to 134.209.82.225.